> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kloudlinq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> The six auth types ccp supports

ccp supports six auth types. Each maps to a different set of environment variables that Claude Code understands, and to a different secret-storage strategy.

## Supported auth types

| Type           | Routes via                                                                                                    | Secret storage                                            |
| -------------- | ------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
| `subscription` | claude.ai Pro/Max/Team/Enterprise OAuth                                                                       | none — `credentials.json` in the profile's own config dir |
| `api_key`      | `ANTHROPIC_API_KEY`                                                                                           | macOS Keychain                                            |
| `gateway`      | `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` (OpenRouter, Requesty, Z.AI, any Anthropic-compatible endpoint) | macOS Keychain                                            |
| `bedrock`      | `CLAUDE_CODE_USE_BEDROCK` + your AWS CLI session                                                              | none — assumes `aws sso login` is active                  |
| `vertex`       | `CLAUDE_CODE_USE_VERTEX` + your gcloud session                                                                | none — assumes `gcloud auth login` / ADC                  |
| `foundry`      | `CLAUDE_CODE_USE_FOUNDRY` + your az session                                                                   | none — assumes `az login` is active                       |

## Subscription

Uses the standard Claude Code OAuth flow tied to your claude.ai Pro, Max, Team, or Enterprise subscription.

```bash theme={null}
ccp create personal --type subscription
```

ccp launches Claude Code's browser OAuth flow scoped to the profile's own `CLAUDE_CONFIG_DIR`. The resulting `credentials.json` is written inside that directory — nothing goes to the shared Keychain.

Subscription profiles cannot be shared across machines: each machine must complete its own OAuth flow. `ccp export` / `ccp import` moves the profile's shape but forces a fresh login on the target machine.

## API key

A direct `ANTHROPIC_API_KEY` from the Anthropic Console.

```bash theme={null}
ccp create work --type api_key
```

ccp prompts once for the key (input is masked). The key is stored in the macOS Keychain under service `ccp-profile-manager`, keyed by the profile's Keychain account reference.

**Materializes:** `ANTHROPIC_API_KEY`

## Gateway

Any Anthropic-compatible proxy — OpenRouter, Requesty, Z.AI, LiteLLM, or an internal gateway.

```bash theme={null}
ccp create openrouter-play --type gateway
```

ccp prompts for the gateway's base URL (for example `https://openrouter.ai/api/v1`) and its bearer token. The token goes to the Keychain; the base URL lives in the profile record.

**Materializes:** `ANTHROPIC_BASE_URL` and `ANTHROPIC_AUTH_TOKEN`.

<Tip>
  Gateway profiles whose base URL contains `openrouter.ai` automatically get a cost-visibility `statusLine` wired into their `settings.json`. See [Profiles](/ccp/profiles#openrouter-cost-visibility).
</Tip>

## Bedrock

Routes Claude Code through your AWS account.

```bash theme={null}
ccp create work-bedrock --type bedrock
```

Bedrock profiles store **no local secret**. They assume `aws sso login` is currently active for the target account and region. `ccp doctor <name>` checks the session's validity before you rely on the profile mid-task.

**Materializes:** `CLAUDE_CODE_USE_BEDROCK=1` (plus your existing `AWS_*` environment)

## Vertex

Routes Claude Code through Google Cloud Vertex AI.

```bash theme={null}
ccp create work-vertex --type vertex
```

Vertex profiles store no local secret. They assume `gcloud auth login` has established Application Default Credentials on this machine. `ccp doctor` confirms ADC is reachable.

**Materializes:** `CLAUDE_CODE_USE_VERTEX=1`

## Foundry

Routes Claude Code through Azure AI Foundry.

```bash theme={null}
ccp create work-foundry --type foundry
```

Foundry profiles store no local secret. They assume `az login` is currently active. `ccp doctor` confirms the Azure CLI session.

**Materializes:** `CLAUDE_CODE_USE_FOUNDRY=1`

## Where secrets live

Secrets for `api_key` and `gateway` profiles live in the login Keychain under a single service name, `ccp-profile-manager`, with each profile's Keychain account reference as the key. Inspect them with the `security` CLI:

```bash theme={null}
security find-generic-password -s ccp-profile-manager -a <account-ref>
```

CLI secret prompts are masked with `*` on input; piped/non-TTY input falls back to a plain read since there's no terminal to leak onto.

Profile records in `~/.ccp/profiles/` hold **only** the Keychain account reference — never the secret itself. Because of that, `ccp export` is safe by construction: it can't include a secret it never had on disk.